Description
This article describes how to alter the default login-attempt-limit and login-block-time for SSL VPN users.
Scope
FortiGate.
Solution
The default login-attempt-limit for SSL VPN users is 2 and the login-block-time is 60 seconds.
This indicates if user enters incorrect username/password combinations continuously twice, the firewall will block attempts and prompt with message as 'Too many bad attempts. Please try again in few minutes'.
Now, the user has to wait for 60 seconds to try to login again.
To increase or alter the value, configure the desired values using the CLI as below.
The above config will help in preventing brute force attacks through SSL VPN.
This method does not apply to SAML user groups. SAML user groups use an Azure application, FortiAuthenticator, or other IDP authentication not in the FortiGate. The FortiGate cannot count each incorrect username/password entry.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.